#CVE

共收录 69142 条相关情报。

漏洞预警2026-10-27 发布MEDIUM

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers wh...

CVE-2026-116825

YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validate

来源摘录 · NVD

#cve #cwe-294

漏洞预警2026-10-27 发布MEDIUM

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafte...

CVE-2026-116824

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allo

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布MEDIUM

YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching mi...

CVE-2026-116823

YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to in

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-27 发布INFO

YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig names...

CVE-2026-116822

YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers t

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-10-27 发布MEDIUM

YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. ...

CVE-2026-116821

YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into S

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-27 发布MEDIUM

YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parame...

CVE-2026-116820

YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers t

来源摘录 · NVD

#cve #cwe-215

漏洞预警2026-10-27 发布HIGH

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.r...

CVE-2026-116819

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-27 发布HIGH

OpenPanel before 3.0.0 contains an unauthenticated ClickHouse SQL injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live...

CVE-2026-116818

OpenPanel before 3.0.0 contains an unauthenticated ClickHouse SQL injection vulnerability that allows remote attackers t

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-89

漏洞预警2026-10-27 发布MEDIUM

OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. A...

CVE-2026-116817

OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access t

来源摘录 · NVD

#cve #cwe-306

漏洞预警2026-10-27 发布MEDIUM

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplyin...

CVE-2026-116815

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated projec

来源摘录 · NVD

#cve #cwe-116

漏洞预警2026-10-27 发布MEDIUM

OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access...

CVE-2026-116814

OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email tem

来源摘录 · NVD

#cve #cwe-532

漏洞预警2026-10-27 发布INFO

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQ...

CVE-2026-116813

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-re

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-10-27 发布MEDIUM

OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped p...

CVE-2026-116812

OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows pr

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-27 发布HIGH

OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function cons...

CVE-2026-116811

OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member

来源摘录 · NVD

#cve #cwe-94

漏洞预警2026-10-27 发布MEDIUM

OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.get...

CVE-2026-116810

OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-27 发布INFO

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking ...

CVE-2026-116809

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unaut

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-10-27 发布HIGH

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.val...

CVE-2026-116808

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-27 发布MEDIUM

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN s...

CVE-2026-116807

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-27 发布MEDIUM

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and m...

CVE-2026-116806

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allow

来源摘录 · NVD

#cve #cwe-269

漏洞预警2026-10-27 发布INFO

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the cli...

CVE-2026-116805

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain

历史摘要 · 未重新核验 · NVD

#cve #cwe-200